Foxit PDF “Flawed Design” Exploitation

**Executive Summary:** Check Point Research describes a Foxit Reader-specific PDF exploitation technique that leverages a flawed user prompt workflow to trigger cmd/powershell launches and download remote payloads; the report analyzes multiple active campaigns (including APT-C-35/DoNot Team and criminal actors), details attack chains delivering downloaders, info-stealers, miners and Remcos RAT, documents builders (Python/.NET), provides YARA rules and numerous IOCs, and offers mitigation recommendations.